[Pepps233]

Summary

Implement the Homebrew channel and the shared self-contained archives it needs. No standalone installer, standalone uninstall command, or standalone self-updater is included.

Publication remains disabled: channels.homebrew is deferred and the release signing-key list is empty until the documented review and qualification gates are approved. This PR preserves the seven incremental implementation commits.

Reasoning

Homebrew should install a reviewed, SHA-256-pinned application without running npm to install Diffex or requiring separately installed Node/npm. Bundling a pinned official Node runtime preserves extension functionality while keeping upgrades under Homebrew ownership. The existing npm release/discovery contract and trusted-publisher workflow identity remain unchanged.

Changes

• Detect the external Homebrew ownership marker before npm heuristics. Pure self-update prints brew upgrade diffexai/tap/diffex before settings/network bootstrap and makes no filesystem or package-manager changes.
• Use bundled Node/private npm for extensions by default while honoring an explicit npmCommand and preserving project trust, lifecycle behavior, and user/project storage.
• Prepare four native archives using pinned Node 22.23.4/npm 10.9.9, verified official signed checksums, the retained reviewed CLI tarball, and the existing installation lock. Preserve third-party legal/source materials under a separate payload gate without weakening npm disclosure checks.
• Add canonical formula generation and narrowly scoped GitHub App automation that verifies public bytes before opening a tap update PR; never merge automatically.
• Integrate retained archives, RSA-3072/SHA-256 signatures, exact-byte public verification, immutable recovery, and gated announcement/latest promotion into build-binaries.yml alongside npm.
• Add native and Daytona acceptance paths for bundled-runtime execution, extension installation, runtime assets, real Brew lifecycle fixtures, ownership refusal, integrity, and data retention.
• Document rollout, key rotation/revocation, recovery, supported targets, and outstanding qualification in docs/release/homebrew.md.

Testing

Passed locally:

• npm run check
• Full credential-isolated ./test.sh non-E2E suite; fixed and regressed GPG's Unix-socket path limit under long macOS temporary directories
• Focused runtime, archive, formula, signing, publication, recovery, and workflow tests, including follow-up tests added after the full-suite run
• Complete Daytona harness Python unit suite: 80 tests
• Ruby lifecycle fixture syntax and local-release help entrypoint
• Conflict-free merge-tree check against current origin/main

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.